How To: Configure the Proxy List for a Load Balancer or Reverse Proxy

Version Affected: All

 

Overview

When anything sits between the client and Identity Platform (IdP) — a load balancer or a reverse proxy — the IdP needs to know the IP address of that intermediary so it can correctly extract the true client IP from the X-Forwarded-For header. Without this configuration:

• Adaptive Authentication IP/Country rules and IIS URL rewrite rules can fail to apply correctly, since they act on the wrong IP address.
• The Audit log records the load balancer's IP address instead of the real client IP.

These are both symptoms of the same underlying configuration gap, and are both resolved the same way.

Configure the Proxy List

1. Open the realm's System Info tab.
2. Scroll down to the IP Configuration section.
3. If Network Address Translation (NAT) changes the IdP's own address to a public-facing one, enter that address in Public Address.
4. In the Proxy List field, list the IP address of the load balancer or reverse proxy, separated by commas if there is more than one.

5. Leave IP Http Header Field Name at its default value unless your environment requires a different header name.
6. Click Save.

Special Considerations

IP addresses in the Proxy List field can be entered in any of the following formats, separated by commas, and different formats can be combined in the same field:

• Specific IP address: for example, 72.32.245.182
• Classless Inter-Domain Routing (CIDR) notation: for example, 72.32.245.0/24
• IP range: for example, 72.32.245.1-72.32.245.254

The following example entry combines all three formats in one field, which is valid:

72.32.245.182,72.32.245.0/24,72.32.245.1-72.32.245.254


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.